{"id":"ghsa-ghsa-q7qp-rjg7-q26m","seq":661293,"kind":"advisory","title":"multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown","url":"https://github.com/advisories/GHSA-q7qp-rjg7-q26m","permalink":"https://vulnpulse.app/items/ghsa-ghsa-q7qp-rjg7-q26m","summary":"影響: npm:multer >= 2.0.0, < 2.5.0 → 2.5.0\nWhen multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while another file's async fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down. busboy then emits an error on a stream that no longer has an error listener, which Node raises as an unhandled 'error' event, and the process exits. A single unauthenticated request is…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-113872"],"tags":["GHSA-q7qp-rjg7-q26m","multer"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:08:22.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}